{"id":"CVE-2016-10137","aliases":["EUVD-2016-1326","GHSA-pc2g-6rqh-gjv7"],"status":"published","title":"An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider...","description":"An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00347,"percentile":0.28542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-310"],"published":"2017-01-13T09:00:00Z","modified":"2026-06-17T00:39:07Z","products":[{"vendor":"adups","product":"adups_fota"}],"references":[{"url":"http://www.securityfocus.com/bid/96852","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://www.kryptowire.com/adups_security_analysis.html","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory"]},{"url":"https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html","tags":["x_refsource_MISC","x_transferred","Press/Media Coverage"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10137"},{"url":"https://github.com/advisories/GHSA-pc2g-6rqh-gjv7"}],"sources":{"cve":[{"id":"CVE-2016-10137","description":"An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.","status":"published","published":"2017-01-13T09:00:00Z","modified":"2024-08-06T03:14:42.351Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-1326","description":"An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.","status":"published","published":"2017-01-13T09:00:00Z","modified":"2024-08-06T03:14:42Z","updated_at":"2026-11-03T02:22:24.738409Z"}],"ghsa":[{"id":"GHSA-pc2g-6rqh-gjv7","title":"An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider...","description":"An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.","status":"published","published":"2022-05-17T02:55:20Z","modified":"2023-01-27T05:05:48Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:42:46.0541Z"}],"nvd":[{"id":"CVE-2016-10137","description":"An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.","status":"published","published":"2017-01-13T09:59:00.233Z","modified":"2026-06-17T00:39:07.78Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:03:33.686843Z"}]}}